package com.legendshop.security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import com.legendshop.oa.security.admin.AdminDaoAuthenticationProvider;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
	
	@Autowired
	private AdminDaoAuthenticationProvider adminDaoAuthenticationProvider;

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.csrf().disable(); //解决springboot中使用spring security，登录url就出现403错误,在xml中配置生效
		http.headers().frameOptions().disable();
//		 // 所有请求均可访问
//		http.authorizeRequests().antMatchers("/", "/login", "/login-error", "/css/**", "/home").permitAll().and()
//		.logout().permitAll();
//		
//		
//		// 其余所有请求均需要权限
//        http.authorizeRequests()
//                .anyRequest()
//                .authenticated();
//        
//        
//        // 配置登录页面的表单 action 必须是 '/login', 用户名和密码的参数名必须是 'username' 和 'password'，
//        // 登录失败的 url 是 '/login-error'
//        http.formLogin()
//                .loginPage("/login")
//                .loginProcessingUrl("/login")
//                .usernameParameter("username")
//                .passwordParameter("password")
//                .defaultSuccessUrl("/index")
//                .failureUrl("/login-error");
//        
//        http.rememberMe().tokenValiditySeconds(60 * 60 * 24 * 7)
//        //设置cookie的私钥
//        .key("");
//        
//        
//        http.logout()
//        //默认注销行为为logout，可以通过下面的方式来修改
//        .logoutUrl("/logout")
//        //设置注销成功后跳转页面，默认是跳转到登录页面
//        .logoutSuccessUrl("/index");
        
	}

	@Autowired
	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
		//auth.inMemoryAuthentication().withUser("admin").password("123456").roles("USER");
		auth.authenticationProvider(adminDaoAuthenticationProvider);
	}
}